Unauthenticated file upload in Joomla extension jDownloads (CVE-2026-61900)

jDownloads versions 4.1.0 through 4.1.5 ship a standalone upload script (`administrator/components/com_jdownloads/assets/upload/upload-handler.php`) that runs outside Joomla's normal request flow with no authentication check, no CSRF token, and no permission check, allowing any unauthenticated remote visitor to upload files to the server and retrieve them over HTTP. The developer confirmed the file was a test component included by mistake. According to the NVD, this vulnerability leads to full remote code execution. Affected versions: - 4.1.0 - 4.1.1 - 4.1.2 - 4.1.3 - 4.1.4 - 4.1.5 We recommend updating to: 4.1.6. CVSS 10.0 · our assessment: act_now Reference: https://mysites.guru/blog/jdownloads-4-1-unauthenticated-upload-flaw/ Details: https://vuln.today/cve/CVE-2026-61900